Slipping past a single non-recursive ../ strip with a nested ....// sequence to read a file outside the served directory
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
Sidestepping a capstone control-flow jailer by handing native-compile a filename instead of a lambda, so the byte compiler reads flag.txt as Lisp and names it in an undefined-variable warning
Steering a byte-CNN malware classifier to a benign verdict with an adversarial comment, then escaping a Java SecurityManager through the trusted MethodHandles lookup
Turning a CKKS Chebyshev sign oracle into a 50-bit binary search using ciphertext additions only, with exact rational interval tracking
Declaring an axiom to fabricate false proofs, turning Lean 4 proof-carrying array accessors into arbitrary memory reads, and forging a closure object to call readFile
Cracking 20 rounds of monoalphabetic substitution across ten languages with space-aware quadgram hill-climbing and a dictionary polish pass
When softplus weights make every added byte incriminating, rewriting a Java SecurityManager escape token by token until a byte-CNN calls it benign
